Critical · published September 8, 2022
CVSS calls it critical at 9.9. It sits in the 99.5th percentile for exploit probability.
🚨 A small oversight in XWiki’s tag document opens the door for a coding free-for-all! 🔥 Think of it like a public library where anyone can slip in a book with instructions to change the entirety of the library system without a librarian checking. It’s as if the library’s catalog is wide open for anyone with a library card to rewrite the rules! An attacker could exploit this vulnerability to execute arbitrary Groovy, Python, or Velocity code, essentially hijacking the entire XWiki installation. This means they could read, modify, or even delete all content, leaving your wiki in disarray! With a CVSS score of 9.9, we’re talking about a critically severe risk that could impact both the integrity and availability of your precious wiki resources!
Think of it like a public library where anyone can slip in a book with instructions to change the entirety of the library system without a librarian checking. It’s as if the library’s catalog is wide open for anyone with a library card to rewrite the rules! This vulnerability arises from improper input sanitization in the 'Main.Tags' document, allowing users with merely view rights to execute potentially dangerous code. Combined with CVE-2022-36092, it could enable an attacker to bypass all rights checks altogether!
An attacker could exploit this vulnerability to execute arbitrary Groovy, Python, or Velocity code, essentially hijacking the entire XWiki installation. This means they could read, modify, or even delete all content, leaving your wiki in disarray! With a CVSS score of 9.9, we’re talking about a critically severe risk that could impact both the integrity and availability of your precious wiki resources! To remediate, update your XWiki installations to versions 13.10.6 or 14.4 immediately. Alternatively, manually patch the 'Main.Tags' document or import the updated version from XWiki 14.4 using the admin UI in versions 10.9 and later. Don’t forget to verify permissions and conduct a thorough audit afterward! You’ve got this! By following these steps, you’ll be back in control, securing your wiki like the hero you are! 🛡️